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FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE 


Date: 01/31/2008 


To : Cyber 

Los Angeles 

From: Los Angeles 

CY-1 

Contact: 


Attn: 

Attn: 


SSA 

CY-1 


Approved By: 
Drafted By: 


Case ID # :^^8A-LA-249816 
Title: 



(Pending) 
lE-SC-IE-N^TQLOGY - VICTIM 


UNSUB 

CHU _ 

Oafriputer Intrusion 
00: LA 


Synopsis: To open the abov e titled case with SA 

TFO USSS Sl j 


co-case agents. 


and 



Details: On January 18, 2008, a denial of service attack was 

launched against several Church of Scientolgoy web sites. The 
attack brought down the entire site on several occasions, forced 
the Church to move its site to outside servers, and to hire 
help to defend against the attack. A group named 
bnymou^ has claimed responsibility for the attack and has posted 
eVeral videos discussing the attack and vowing to continue. 

Writer requests this case be opened. 


b6 

b7C 


b6 

b7C 








( 




To: Cyber From: Los Angeles 

Re: 288A-LA-249816, 01/31/2008 



LEAO(s) : 

Set Lead 1: (Info) 

CYBER 


AT WASHINGTON, D.C. 
Read and clear. 


♦♦ 


2 











U.S. Department of Justice 


Federal Bureau of Investigation 


File No. 288A-LA-249816 



Office of the Legal Attache 
United States Embassy 
Canberra, Australia 
(011)612-6214-5862 
Fax: (011)612-6273-3294 


Ded 


25 February 2008 


b6 

b7C 

b7D 


On 18 January 2008, a distributed denial of service attack was conducted against the 
Church of Scientology website. FBI investigation determined that the hackers utilized the 
website Gigaloader.c om to conduct this attack. The Los Angeles Division of the FBI recen tly 


served a subpoena to 


which then forwarc 

led the subpoena to the 



Upon receiving this 


subpoena, 


to solicit advice on this matter. A ccordingly. 


contacted the 


contacted ^U-A'B 


to inquire about the subpoena. FA 
Jprovided the contact information for the FBI Agent in Los Angeles which was included on 


the subpoena. 


b3 

b6 

b7C 

b7D 


A fter consulting with the Los Angeles based case agent, i t became clea r how the 


subpoena 

The case agent also advised that 

had contacted him 

via telephone and indicated thatl 


1 b6 

1 

1 Ibeing requested in the subpoena. 


REQUEST OF 


b7D 



b6 

b7C 

b7D 




'J - ^7=^ - 

^ I.ncIoMirc \iiachmeni(s) 7 

CKvo LVi-e C loar load . serial 












b7D 


Please direct yo ur response and a nv questions regarding this matter to the attention of 
Assistant Legal Attache 


b6 

b7C 


Sincerely, 

Scott L. Cruse 
Legal Attache 

_ 

_I b6 

-1 b7C 

Assistant JLegai Attache 









FD-919 (Rev. 06-05-2003) 


FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE 


Date: 02/08/2008 


To: Los Angeles 


From: Los Angeles 



Title: VICTIM NOTIFICATION FORM 

Synopsis: Victim Contact Information 

Reference: 288A-LA-249816 Serial 1 

Details: 


M 


VnsCase# 

CAgtName 

PContact 

BusName 

BusEIN 

BusAcct 

VicFirN 

VicMidN 

VicLastN 

SSAN 

VicDate 

VicDOD 

VicMinor 

DOB 

Race 

Sex 

Addr 

Addr2 

City 

State 

Country 

Zip 

Email 

HPhone 

Fax 


288A-LA-249816 


B^iness- 

^urch_oJ_B,cAe,n j :;,oXQ.q-VL,^ 
000000000 


20080118 


b6 

b7C 



■ 2 ^ 




* ^ 


he 

hlC 







♦ • 

To: Los Angeles From: Los Angeles 

Re: 288A-LA-249816, 02/08/2008 


VWrkAddr 

VWrkadd2 

VWrkCity 

VWrkSt 

VWrkCtry 

VWrkZip 

VJEmail 

WPhone 

WFax 

VicPager 

NOKFirN 

NOKMidN 

NOKLastN 

NOKRel 

NOKAddr 

NOKAddr2 

NOKCity 

NOKState 

NOKCtry 

NOKZip 

NOKHEmal 

NOKWEmal 

NOKHPho 

NOKWPho 

NOKHFax 

NOKWFax 

NOKPager 

GrdFirN 

GrdMidN 

GrdLastN 

GrdRel 

GrdAddr 

GrdAddr2 

GrdCity 

GrdState 

GrdCtry 

GrdZip 

GrdHEmal 

GrdWEmal 

GrdHPho 

GrdWPho 

GrdHFax 

GrdWFax 

GrdPager 

PropRet 

TotLoss 


3055 Wilshire Blvd 

Suite 900 

Los Angeles 

CA 

US 

90010 



2134875385 


N 

000000000 


Lang. 

Disable 


EN 


b6 

b7C 


2 








Los Angeles From: Los Angeles 
288A-LA-249816, 02/08/2008 
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FD-302 (Rev. 10-6-95) 


FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 02 /19 /2 008 

















(Rev. 06-04-2007) 


FEDERAL BUREAU OF INVESTIGATION 


Precedence; ROUTINE 
To; Cyber 

International Operations 

Los Angeles 


Date; 03/12/2008 


Attn; 

SSA 

1 

Attn; 

Asia Unit 


UC [ 

1 


SSA 



FOS 


Attn: 

Sauad CY-1 


saF 



b6 

b7C 


From; Canberra 

Contact; ALAT 


Approved By; Cruse Scott L 
Drafted By; 


Case ID #; 288A-LA-249816/\^ (fending) 

Title; UNSUB(S) 

CHURCH OF SCIENTOLOGY - VICTIM 
COMPUTER INTRUSION 
00: LA 


b6 

b7C 


Synopsis; f 


Administrative; Reference telenh^ one cal l from I 

to ALAT begat 

(Janterra, on 02/24/08. Also referenc e telephone ca ll from Legat 
Scott L. Cruse, Legat Canberra, to SA FBI Los 

Angeles, on 02/25/08. 

Enclosure(s); Enclosed for the Los Anael es Division is one 


Deta ils; On 02/24/0 8, 
ALAT I 


, , _, contacted 

Ireaardina a US Federal Grand .Tnrv fiiibnop.|ia 


b3 


b6 

b7C 

b7D 


b3 


b3 


consulting with SA 
determined the subpoena had been 


1 This subpoena requested b6 

b7C 

After b7D 


FBI Los Anaeles. it was 


saF 


also advised that 


had contacted him and 


b6 

b7C 


Send KGieticr/fax (Secure_) 

Cnclosure{ (TAnachmemi^ / 
_Close Case “Vicar lead serial_ 


1 ^ 



















Cyber Frort^^ Canberra 
288 A-IjA-249816, 03/12/2008 


_[requested in the subpoena. 

Accordingly, ALAT I contacted I 

and requested t] ie assistance of j _ 

| . On 03/11/08, ALAT 
are enclosed with this communication. 


which 


This information is provided for whatever action is 
deemed appropriate. 


2 







To: Cyber Frori^ Canberra 

Re: 288A-LA-249816, 03/12/2008 


LEAD(s) ; 

Set Lead 1: (Info) 

ALL RECEIVING OFFICES 

For your information. 
Set Lead 2: (Discretionary) 

LOS ANGELES 

AT LOS ANGELES. CA 


For action deemed appropriate. 











FD-302 (Rev. 10-6-95) 


FEDERAL BUREAU OF mVESTIGATION 


Date of transcription 03/06/2008 


I _ I was interviewea via ceiepnone rrom nis piace o: 

employment. After being advised of the identity o f the 
interviewing agent and the nature of the interview ! provided 

the following information: 


ickets tor this user ID. 


There are no help des 



tated that there could be missing data on the 
with regard to all the possible connections. 


Investigation on 03/03/08 

at Los Angeles, CA 

(telephonically) 

File# 288A-LA-249816 — 


Date dictated 


This document contains neither recommendations nor conclusions of the FBI, It is the property of the FBI and is loaned to your agency; 
it and its contents are not to b e distributed oiitsidp; vniir agfinr.v 












(Rev. 06-04-2007) 


FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE 

To: Newark 
Omaha 

PhiladeIphia 

From: Los Angeles 

CY-1 

Contact: F 
Approved By: 


Date: 05/20/2008 

Attn: Trenton RA - Cyber Supervisor 
Attn: Grand Island RA - Cyber Supervisor 
Attn: Scranton RA - Cyber Supervisor 


Drafted By: 

Case ID #>»^8A-LA-249816 " (Pending) 

Title: UNSUB(S) 

CHURCH OF SCIENTOLOGY - VICTIM 
Computer Intrusion 
00: LA 

S 3 fnopsis: To set a lead to Newark, Omaha, and Philadelphia to 

conduct witness/subject interviews related to the computer attack 
described below. 

Details: On January 18, 2008, a denial of service attack was 

launched against several Church of Scientolgoy ("COS”) websites. . 
The attack brought down the entire site on several occasions, 
forced the COS to move its site to outside servers, and forced 
the COS to hire outside help to defend against the attack. A 
group named Anonymous has claimed responsibility for the attack 
and has posted several videos on YouTube discussing the attack 
and vowing to continue. 

Investigation into the attack has identified several 
subjects throughout the United States including the following: 



I I was a Freshman at| 

the time or tne attack and resided in a resiaence na± 
The spring semester ended May 9, 2008. The address 1 
is his permanent address, likely that of his parents, 
has no other addresses listed. An Internet Protocol 



|at 

on campus. 



address linked to 


through computer records provided 








Omaha 


To: Attn: TifShton RA - Cyber Supervisor 

From: Los Angeles 

Re: 288A-LA-249816, 05/20/2008 


by 


hit COS websites hundreds of thousands of times 


across three different attP-chs., 



I wa g~a~strade'rrt~a t 

the attack and resided in a resiCenct 


of 

hall but different room as| 
listed ab ove is h is permanent address, 


parents. 
linked to| 
hit COS wePsites 
attacks. 


the time 
nail on campus (same 
below). The address 
ikely that of his 
listed. An IP address 



|has no other addresses 

through computer records provided by[_ 

over 1 million times across three different 

_ / ' ' __ 



was 3" “'student—a-t- 

the attack ana reside d in a r esidence hall on campus 


but different room as 


|at.,the tirne of 
(same hall 


The address li sted abov e is his 


permanent address, likely tnat of his parents. 
other addresses listed. An addre ss linked to 
computer records provided by 


million times across three different attacks. 


^as no 
, through 
hit COS websites over 1 











To: Attn: Trenton RA - Cyber Supervisor" 

From: Los Angeles 

Re: 288A-LA-249816, 05/20/2008 


LEAD(s): 


Omaha 


Set Lead 1: (Action) 


OMAHA 


Interview . , 


_|, at his Home Address .|_ 

and ask the following questions 




It I |does not currently reside at the location, 

please interview any relative or person with knowledge as to his 
whereabouts and provide any contact information available. 

Set Lead 2: (Action) 

NEWARK 


Int erview I 
Address, | 

following questions: 


at his Home 
and ask the 











Attn: Trehton RA - Cy 
Los Angeles 

288A-LA-249816, 05/20/2008 


Cyber Supervisor 


Omaha 


It|_poes not currently reside at the location, please 

interview any relative or person with knowledge as to his 
whereabouts and provide any contact information available. 


Set Lead 3: (Action) 


PHILADELPHIA 


Int erviewI 
Address, | 
questions: 


_I at his Home 

land ask the following 










To: Attn: Trenton RA Cy 

From: Los Angeles 

Re: 288A-LA-249816, 05/20/2008 


Cyber Supervisor 


Omaha 


It|_[does not currently reside at the location, please 

interview any relative or person with knowledge as to his 
whereabouts and provide any contact information available. 











(Rev. 01-31-2003) 


FEDERAL BUREAU OF INVESTIGATION 


Precedence; ROUTINE 
To: Los Angeles 


Attn; SA 


Date; 07/14/2008 


CY-1 


From; New York 

Squad C-37 , 

Contact; SA 


Approved By; 

Drafted By; ((^ 

Case ID #; 288A-LA-249816 (Pendinc ^ 

Title; UNSUB(S) , 

CHURCH OF SCIENTOLOGY - VICTIM -Z^ 

COMPUTER INTRUSION 
00: LA 

Reference; 288A-1^-249816 Serial 25 
Synopsis; To document covering of lead. 

Details: On July 2, 2008, SA coordinated resources between the 

Los A ngeles and New Yo rk Divisions ot ECTF and FBI. An email was sent 
to SA (ECTF-LA) and SA | I (FCT F-NY), 

indicating tnat SA | ^nd SA] from FBI-NY 

would assist in the searcn. SSA's for FBI-LA, FBI-NY and ECTF-NY were 
copied on the emai1 ._and the necessary o perational information was 

provided to SA and SA I I 

'-' I-1 b6 

New York considers this lead covered. 









To: Los Angeles From: New York 

Re: 288A-LA-249816, 07/14/2008 


LEAD (s): 

Set Lead 1: (Info) 


LOS ANGELES 
AT LOS ANGELES. 
Read and clear. 


♦♦ 


CALIFORNIA 


2 



FD-302(Rk 10-6-95) 


FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 07 /24 /2008 


_ On Ju ly 23, 2008, | L date of bi rth 

[ social secur ity account number of|| 

I was interviewed b v Special Agents 

___ Prior to the 

interview, ! | was advisea ot the interviewing agents' identities 

and purpose of the interview. He thereafter stated the following: 


He was academically dismissed fromf 


appr oximate ly four weeks ago; he fail 
GPA. I { completed two years atj__ 
Engineering. The last nine months at 

btated I Iwa 


iled t o maintain the required 
Imajo ring in Mechanical 
at ] j his room mate was 

was majoring in Information 


Technology but was not sure of the minor. 

_ I heard about the inte rnet group "anonymous" through 

] Accor ding to! { and approximately 20 other 

individuals at | [were upset a bout a v ideo featuring movie 

actor TOM CRUISED TEe group, which| jknew no other names of, 

protested at the CHURCH OF SCIENTOLOGY (COS) located in 
Phila delphia. The group met at City hall then went, to the protest. 

_stated he was not a member of the group "anonymous" nor did he 

attend the protests. 


The onl y other individu al j_{believes ma y be a m ember 

of "anonymou s "is! {(spel ling provided by_. 

Accordi ng to {were close friends and ta lked 

often. resided next door to 


{_{advised in approximately January this year, |_ 

went to various websites looking for programs to initiate DDOS 
at tacks. He pro vided the following sites: 


{ {was a ble to locate a program;!_{did not know 

the name or it. \ {stated he saw the program and described a 

"nifty" screen that came up where you wold input the target IP 
address and several other pieces of inform ation and it would send 
"packets" to the site. According to { \ for appr oximately a week 
straight in late January or early February, { land the group 


Investigation on 7/23/2008 
File# 288A-LA-249816 


Date dictated 1 f 24: f 2008 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 










FD-302a(R;ev. 10-6-95) 


288A-LA-249816 


Continuation of FD-302 of 


■ On 7/23/2008 .Page 


b6 

■b7C 


"anonymous" sent two la rge D DOS atta cks and several smaller attacks 
against the COS. | |knows] |to own a Mac Book and a Dell 

Desktop. _used both computers in their room. The DDOS 

attack s were se nt using the Dell computer. On one occasion. 


saw on 


_ monitor approximately 15 of the "nifty" windows. 

The wind ows were downsized and all running at the same time and 
];old him they were directed toward COS. 


1 believes] 

luses AOL 

communicate with his fr: 

Lends at 



did state 
or similar 


has 

1 

and i 


Instant Messenger (AIM) to 
and IRC to communicate with 
__He 

a myspace account and thinks it's 


myspace account can be f ound by just n ^'s name 
-t is not set to private . I J advised 

Jtv 


myspace acco unt 


and located friend 

1 

friend ID 

writer believes this to be 


account) 


[ 


stated he was not involved in any of the DDOS 


attacks against the COS and knows very littl e about computers. He 


b6 

b7C 


further stated. 


did use his 


complete and print school work 


b6 

b7C 


]computer on occasion to 


b6 

b7C 











FD-302 (Rev. 10-6-95) 


FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 07 /17/2008 


L date of birth SSAl 


I, was interviewed at his b6 

residence. After being advised ot the nab ure of the int erview, and b7c 
the identities of the interviewing Agents, p rovided the 

following information: 

I [ stated that has lived at his current 

residence for about two m onths. He sta ted that a total of six 
people live in the house. | I stated that he is currently b6 

looking for a job. Prior to moving tol _ I resided b7c 

with his par ents at | | 

Irecen tlv completed his freshman year at| 

Iwhere he was majoring in Aerospace Engineering. 


and that 


■ 


1 

_1 


stated that he did not plan to return to 
■anned to enroll locally at | 

_^stated that he wasn't returning 


because his interest level was low and the out of state tuition 


was very expensive. 
pay for his tuition. 


stated that he took out loans to 


was asked 3 ,f he was fami liar with the 
Internet group called ANONYMOUS. said h e has visited 

some of the same websites as the group' s membership. _ 

said the gro up was made up of people with no real agenda. 

Istated the group communi cated via an image board on the b6 
website|[stated that he hasn 't been on b7c 

the message board in at least five months. __ stated the 

name of the board is _ He stated that various subjects 

were discussed on the board such as computer gear, tech questions, 
etc. 

was asked about his computer skills. He 
stated that he is a Microsoft Windows guy and specifically Windows 
VISTA. He s tated that he hates the Linux operating system. 

stated tha t he would o ften answer technical questions 
on tne message board. | 1 stated that the postings on the 

message board were all anonymous.I[also viewed the 
website^^which he stated is similar in nature to 


Investigation on 07/17/2008 at Omaha, Nebraska 


File# 288A-LA-249816 


Date dictated 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 










FD-302a (Rev. 10-6-95) 


288A-LA-249816 


Continuation of FD-302 of 


■ On 07/17/2008 


I_I was asked if he commun icated with any of the 

arour)' a mem -)R-rR "offline" meaning not on the__^website. 

stated h e did log into the group 's IRC channel which he 
believed was via the website. I I stated 

there was nothing going on in the chat room and that there was no 
password to get into the chat room. 

was asked if other individuals in the house 

would be able to provide information about tha Internet group_ 

ANO NYMOUS. He stated that house mates P I 

and_have also viewed the ANONYMOUS website. 

_stated that there was about seven computers 

in the house including desktops and laptops. All of the computers 
are in a common area in the basement of the house. The Internet 
connection to the house is provided by COX' COMMUNICATIONS, and is at b6 
least a 15 megabyte connection. They are running a wireless b7c 

network for the laptops and Ethernet to the desktops w ith the 
router being located in the living room. [ stated that 

th ^rp 1 .q no -naa Rword on the router and that the service is probably 
in name. 

|was asked again about his frequency of 
viewing the ANONYMOUS message board or website. He stated that the 
last time he- remembered viewing the website was around New Year's b6 
Day 2008. j [stated he had been viewing the website for b7c 

at least three years and that he had just stumbled upon the group 
on the Internet. 

[ was asked again about communicating with 

members of the group. He stated that he had added two individuals 
affiliated with the group to his IM list. He stated that he had 
chatted with the two individual via IM every now and then. b6 

[ L ater provided a sheet of paper containing contact e- b7c 

mail addresses for what he described as three individ uals _ 

affiliated with ANONYMOUS. The e-mail addresse s were_ 

[ and 


[ [was asked if he could provide any information 

pertai ning to the gr oup's stance towards the Church of Scientology 
(COS). [ [stated that he knows the group doesn't like the 

COS. He stated that the group' s membership tri ed to bring down the 
COS website in about August 2007. [ Istated that people 







FD-302a (Rev. 10-6-95) 


288A-LA-249816 


Continuation of FD-302 of 


.On 07/17/2008 


posted messages on the ANONYMOUS website encouraging people to 
attack the COS- website. 


I___|was av 

website actually happened, f 


:he DOS attack on the COS 
Iwas asked if he 


participated in the attack on the website. __[stated that 

"I was involved for a little bit", j I ini tially stated 

that he did it once and then stopped. [ later stated 

that he participated in the DOS attack at least three times over 
the course of a weekend. 


[_[stated that he dow nloaded a ‘progr am that was 

posted on the ANONYMOUS message board on land loaded 

it on to his desktop computer in his dorm room at f [ 

stated the program, which might have been call ed ION BLASTER, ran 
on the Windows operating system. [ stated he launched 

his attacks from his dorm room and that he had a really fast 10 
megabyte connection. 

stated he didn't respond to any postings on 
the webs ite regarding the attack and that he just downloaded the b6 

program. [stated he does not know who else participated b7c 

in the attack. [ stated that the desktop computer he 

usp^d fn-r thp^ ati-afk.Q is With him at his current residence of 

_was asked if anyone else h ad access to the 

desktop computer in his dorm room. _stated no one else 

had access to the desktop computer. He state d~~that he did not have 
a roommate while living at | ~[ was unaware if anyone 

else on the [ [ campus participated in the DOS attacks. 

[ does not know if any of his current roommates 
participated in any of the attacks on the COS website. 

[ [was asksd ab out the motivation for the attack 

on the COS website. | stated that the COS beliefs are 

weird and that it was not about they believe but how they charge 
people hundr eds of dollars to move forward in their religion. 

_stated that charging peopl e for particip ating in 

religion is not what religion is about stated that 

participating in the attack was fun, sometning new and-interesting 
to do. 


was asked if k new that his p articipation in 
the attack was a criminal violation. |[stated that he 
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know his actions were a criminal violation and illegal but d idn't 

think the FBI would be showing up at his door. __was 

as ked again if anyone had access to the computer in his dorm room 

at Ist ated that he was the only one who had access 

to his computer at I that he h ad no roommate and that he locked 
his dorm room door. [ stated he did use a password with 

his computer. 

I [ was asked about access to his computer now at 

his current residence. He stated that everyone in the house has 
access to each other's computers. 

I was advised that the investigation has 

indicated that IP a ddresses used in the attacks on the COS website 

traced back to him. | Istated tha t he understood the IP 

addresses traced back to him, j [was asked for his 

consent to search his desktop computer. [ [ asked if the 

Agents ha d a warrant an d then refused his consent to search his 
computer.[ [stated that he has reformatted the hard 

drive in the computer several times. 

_was asked if has committed any other Internet 

or computer based attacks beside the DOS on the COS website. 

[stated tha t he has not participated in any other 

attacks. _was asked if he or any of his roommates were 

involved in any illegal activities such a s computer hac king and 
intrusions, piracy, or child pornography. [ stated that 

neither he or his roommat es were involved in any illegal 

activities. _stated that he has downloaded some music 

from the Internet but that most of it was Techno which is mostly 
free to download. 


1 - 

was asked if ! 

activities. 

_ 1 


ANONYMOUS activities. |_[stated that the group also 

requested that its membership prank the COS phone lines. The group 
also asked their membership to prank their local GAME STOP stores. 

was again aske d if he knew a nyone else in the 
group either online or in real life. [ [ stated that he 

doesn't know anyone else in the group. 

[ I was asked about his financial status and how 

he affords his share of the rent. He ’stated that his parents are 
helping him out financially and that two of his roommates work at 
POWERDNN, a local co-location facility. The two individuals are 
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ILNU anc 


stated that in addition to 
the othe r occupants of the house 
(sp?)LNU. 


The in terview was t hen terminated. The notes detailing 

the interview of_ and the sheet of paper containing the 

three e-mail addresses provided by , were placed in a 1- 

A envelope and secured in the case 


lie. 
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Precedence; ROUTINE 


To; Los Angeles 

From; Omaha 

Squad 4 ^ 

Contact; SA 

Approved By; 


Squad CY-: 


Drafted.By; 


Case ID #; 2 88A-LA-249816 (Pending) 


Title; UNSUB(S); 

CHURCH OF SCIENTOLOGY - VICTIM 
Computer Intrusion 
00: LA 

Synopsis; To document covered lead. 

Enclosure(s) ; Enclosed for Los Angeles are two (2) conies o f an 
FD-302 docum enting a 07/17/2008 interview of | 

_and one (1) 1- A envelope co ntaining interview notes 

and a document provided by _ 

Details; O n 07/17/2008, pursuant to a lead, writer and SA I 

llocated an d int erviewedP date 

of birthi I SS An P \ 

_was interviewed in regard to any 

information he might possess regarding a DOS attack on a website 
maintained b v the Church of Scientology. During the interview, 
confessed to participating in the DOS attack against 
the victim website. 

Omaha considers this lead covered and all pertinent 
documents are being forwarded to Los Angeles. 


UNCLASSIFIED 
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# 

To: Los Angeles From: Omaha 

Re: 288A-LA-249816, 07/29/2008 

LEAD(s) ; 

Set Lead 1: (Action) 

LOS ANGELES 

AT LOS ANGELES. CA 
Read and clear. 

♦♦ 


UNCLASSIFIED 
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Precedence: ROUTINE 

To: Los Angeles 

From: Newark 

Franklin Township RA 

Contact: I 


Attn: 


Date: 08/06/2008 


Approved By: 
Drafted By: 


Case ID #^^88A-LA-249816 (Pending) 3 ^ 

Title: UNSUB(S) 

CHURCH OF SCIENTOLOGY - VICTIM 

Computer Intrusion 

00:LA 


Synopsis: Attempt to locate|_| 

Enclosure(s) : Department of Motor Vehicles Report for [ 

Details : On August 6, 2008, SA | ~land SaI | 

1 attempted to locate and interviewl lat his 

parent.g^ re.cii He nr-.p ; I___I 

] mother provi ded that ' was livi ng in _, 

l in off-campus_ st uaenr housing. | _ 

mother provided the cellpho ne numberl land thatl 

is working as an intern for _ 

I work phone n umperl t Monday through 

1:riaav tr om 9am until 5pm. _ motner further provided that* 

I cell ph one had no power l eft and that his charger was at 

home. I mother stated that_comes home almost every 

weekend"! 

On August 6, 2008, the Publ ic Safety Department 
provided an email address for I lof 


On Augu st 6 , 2008, |_ y telephone | 

I provided SA | ~lwith the apartment complex th^ 
now living in calleTI [located on I 


UNCLASSIFIED 







UNCLASSIFIED 


To: Los Angeles From: Newark 

Re: 288A-LA-249816, 08/06/2008 


confirmee;! 1 

lived in aoartment # 

_1 

home 

phone # 

. cell phone # 



I |was not present at his apartment on August 6, 

2008, at approximately 6:30pm. 


♦♦ 


UNCLASSIFIED 
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Date of transcription 08 720/2008 


On August 20, 2008, 


stated that he was 


going to take the 5th on his rights in speaking with the FBI, but 
he did provide his attorney's name and contact information as 
follows: 


b6 

b7C 


that 


On August 20, 2008, 
was represen 





ting 




office did confirm 


Investigation on 8/20/2008 at Somerset, NJ (telephonically) 

File# 2 8 8A“LA“2 4 9816 / 3 ^ Date dictated _ 

by SA I _ 


b6 

b7C 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 
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Precedence: ROUTINE Date: 07/30/2008 

To: Newark Attn: Garret Mountain RA - Cyber Supervisor 


From: Los Angeles 

CY-1 

Contact: 

Approved By: 

Drafted By: 

Case ID #: 288A-LA-249816 (Pending) ^ 

Title: UNSUB(S) 

CHURCH OF SCIENTOLOGY - VICTIM 
Computer Intrusion 
00: LA 

Synopsis: To set a lead to Newark, Garret Mountain RA to conduct 

a witness/subject interview related to the computer attack 
described below. 

Details: On January 18, 2008, a denial of service attack was 

launched against several Church of Scientolgoy ("COS”) websites. 

The attack brought down the entire site on several occasions, 
forced the COS to move its site to outside servers, and forced 
the COS to hire outside help to defend against the attack. A 
group named Anonymous has claimed responsibility for the attack 
and has posted several videos on YouTube discussing the attack 
and vowing to continue. 

b6 

In addition, approximately twenty-two hoax white powder b7c 
letters were mailed to COS locations in the Los Angeles area and 
several bomb threats have been mad e to var ious COS locations. 

However, the information linked to| |is related to the DDOS 

only. 

Investigation into the DDOS attack has identified 
several subjects throughout the United States including the 
following: 


b6 

■b7C 









he 

hlC 








m 


To: Attn: Garret Mountain RA 

From: Los Angeles 

Re: 288A-LA-249816, 07/30/2008 


- Cyber Supervisor 




internet user name 


Open sou rce resea rch provided by COS links |[ 


found braggi ng in an o nline forum 


] to an 


also states that 


about participation in the DDOS attack._ 

he has gotten really involved with Anonymous and met some of the 
people in New Y ork. have not yet identified an IP address 

associated with^ 


I with 

The addres s given above is| 

and is thought to be that of his parents. 


b6 

b7C 


b6 

b7C 

b7E 


2 





To: Attn: Garret Mountain RA - Cyber Supervisor 

From: Los Angeles 

Re: 288A-LA-249816, 07/30/2008 


LEAD(s): 


Set Lead 1: (Action) 


NEWARK 


AT GARRET MOUNTAIN 


Interviewl 


:ollowing questions: 


Tel: 


at his resi dence. 96 

I and ask the 


iq_I does not currently reside at the location, please 

interview any relative or person with knowledge as to his 
whereabouts and provide any contact information available. In 










To: Attn: Garret Mountain RA 

From: Los Angeles 

Re: 288A-LA-249816, 07/30/2008 


- Cyber Sii^rvisor 


addition please ask for consent to take and search 
computer and/or for him to provided any evidence avaiianie. 


4 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 10/15/2008 


I Social Security Account Numberf 


J. white male. date o f birth 


number! 


_ residing at 

_ cellular telephone 

__|was interviewed at the Newark Field Office of 

the Federal Bureau of Investigation, 11 Centre Place, Newark, New 
Jersey. After being advised of the ide ntities o f the interviewing 
Agents and the nature of the interview,] provided the 

following information: 


At the beginning of the interview, ] { read an FD-395, 

Advice of Rights form, initialing after each line and signing the 
form. The signed form was placed in a lA envelope. 


articles were typically from "credible" sources 
MAGAZINE and TIME. Beginning in December 2007]_ 


such a s WIRED 

]began seeing 


articles on the groups ANONYMOUS and the CHURCH OF SCIENTOLOGY 
(COS) appearing on the front page of the website. 


In January 2008, 


] began seeing additional articles 
on DIGG describing Distributed Denial of Service (DDOS) attacks 
occurring against COS. The articles indicated that the DDOS 
attacks were perpetrated by members of ANONYMOUS. In addition to 
the DDOS attacks, there were also articles and discussions 
regarding a COS TOM CRUISE video that had been leaked onto the 
Internet and posted on YOUTUBE, a website for posting videos. In 
the Blogs, including on DIGG, users described CRUISE as looking 
"nuts." The number of articles and discussions on both the DDOS 
attacks and on the CRUISE video began fading in February 2008. 


I_I interest in COS was generat ed after reading 

about cos's policy referred to as "Fair Game." I I provided a 

copy of the "Fair Game" policy which was placed in a lA envelope, 
felt the "Fair Game" policy amounted to harassment. 


b6 

b7C 


b6 

b7C 


_ | Ls a big reader of the website WWW.DIGG.COM (DIGG) 

which is a social news website. News articles on the website are 
rated by readers by either giving the articles a "Digg up" or a 
"Digg down." When an article receives h igh rating s, they are 
placed on the front page of the website. I [ indicated that the 


b6 

b7C 


told 


AJi a Super Bowl party on January 23, 2008, 


b6 

b7C 


b6 

b7C 


b6 


labout a protest that was planned for February 10, 2008 b7c 


Investigation on 10/14/2008 at Newark, NJ 


File u 288a-T.a-?4gsi -^.3 7 

SA 


Date dictated n / a 


by SA 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 


b6 

b7C 
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, On 10/14/2008. , Page 2 b6 

b7C 


by ANONYMOUS at 



City. I_|had learned about jjg 

attended the protest with both 


I H described ANONYMOUS as a leaderless organization 

with the coitimon goal of bringing a stop to the "crimes and abuses" 
perpetrated by COS. Although he thinks ANONYMOUS has focused on 
other entities or activities, since at least December 2007 there 
focus was on COS. ANONYMOUS has a lot of members but has very 
little control over their activities. Most of ANONYMOUS's 
activities include spamming COS websites and posting " nonsense" on 
websites such as channel B on www.4chan.com. | ^ oes not think 

that ANONYMOUS is focused on COS anymore. 

CHANOLOGY is a group that e merged o ut of ANONYMOUS and is 
still active today. CHANOLOGY, which \~ [ considers himself part 

of, has continued to focus on protesting the abuses of COS and the 
COS policy of "Fair Game." CHANOLOGY continues to sponsor monthly 
peaceful protests against the COS located in New York City. b6 

CHANOLOGY abides by the law and has a good relationship with the b7c 
New York City Police Department in how they conduct their protests 
across from the COS. CH ANOLOGY conducts protests against COS all 
over the world. I ~| indicated that any protest group protesting 

COS around the world is probably associated with CHANOLOGY rather 
than ANONYMOUS. 

Several members of CHANOLOGY have been targeted and 
served with Cease and Desist letters (C&D) by COS. A private 

investigator hired by COS attempted to serve a C&D on_ at his 

parent’s address in M av 2008 but was unsuccessful. The private 
investigator was told | | no longer lived at the address. 

I I provided interviewing Agents with copies of 

several C&D letters that had been served on members of CHAN OLOGY. 
Included with one letter served on member [ at his 

house, was a photograph and description of the harassing way in 
which the letter was served by a member of COS's security. In 
addition to this let ter, an "Anonymous No More" fiver was left at 
_t±L£_i2esidence naming [ true name, , 

Halso prov ided a draft copy of a legal brief written by 

_ responding to a restraining order requested by COS 

on LNU. All of these documents were placed in a lA 

envelope. 
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_I Based on what was in some of the C&D letters from COS, 

_I was aware that COS claimed to have rec eived bo th bomb 

threats and letters containing white powder. _questioned the b6 

truth of these claims because members of CHANOLOGY had not been b7c 

able to find copies of police reports to back up the COS reports, 

_knew of two websites that were used by CHANOLOGY 

members to communicate regarding activities planned against COS, 

C&D letters received by members and other COS rel ated information. 

The largest website is WHYWEPROTEST.NET. | 1 estimates this 

website has approxim ately 17 ,000 members. The second website, 
which was created by | in March 2 008. was EP ICANON.COM. This 

website has approximately 600 members. | ~| i sl ~l 

for both websites and uses the same screen name, | 
is the o nly one that has access to and utilizes the screen name 
_on both aforementioned websites. 

I ~| indicated that there have been some screen names 

that have been banned on these websites because they mad e postings j^g 
encouraging activities such as DDOS attacks against COS. I 
was willing to provide interviewing Agents with a list of these 
user names and IP addresses associated with them. 

_ provided a copy of the Domain Name registration 

for EPICANON.COM showing the date of domain registration as March 
18, 2008. 

stated that as __ he is 

familiar with what a DDOS attack i s and has seen how much damage 
such an attack can cause. I "I denied participating in any of 

the DDOS attack a ctivity t hat occurred against the COS in January 
or February 2008. | [ further stated that no IP address 

activity related to the DDOS attacks would link to him. 

I ~| indicated that he had not posted anything on 

EPICANON. COM claiming to have participated in the DDOS attacks 
against COS. | also denie d having ever mailed letters 

containing white pow der to CO S. | \ denied making bomb threats 

to any COS location. _did not know anyone who had 

participated in any such attack or activity. 


Intervie wing Agen ts th en showed I |a copy of a post 

on EPICANON.COM by | ^ |dated] jwherej jclaimed b6 

to have participated in some of the DDOS attacks against COS. b7c 

_stated that he had forgotten about that post and admitted to 
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b6 

'b7C 


having made the po st. 
the DDOS attacks. 


continued to deny participating in 


stated that he lied on the post initially 
because he thought that this was what people wanted to hear. A 
printout of the post was placed in a lA envelope. 


18 , 


Interviewing Agents provid edf 
United States Code Section 1001, 


with a copy of Title 


read the document and 
signed indicating he understood what the section meant. The signed 
copy was placed in a lA envelope. 


attacks against COS. 


aga in denied that he had participated in DDOS 


again stated that no IP address 


activity related to the DDOS attacks would link to him 



lis currently employed as 

□ 


for 1 



|tor the last tour or 

five months. 

His boss is 1 

X 

cellular telephone 


office telephonel 

□ 

In 

January and February,1 

Ibelieved he was employed 

bvl 

L an IT solutions 

company, located in 


i telephone 

J 

His boss was LNU. 


had attended approximately two years of college. 


^ , jhad moved back in with his parents at __ 

Jin June or July, 2 p08. In January and February 2008, he lived 


with his girlfriend at 


b6 

b7C 


b6 

b7C 


b6 

b7C 


b6 

b7C 


b6 

b7C 


b6 

b7C 
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From: Newark 

FTRA2 _ 

Contact : SA 

Approved By: 

Drafted By: 

-- 

Case ID #: 288A:>IrA'^249816•^’^®(Pending) 


Title; 


UNSUB(S) 

CHURCH OF SCIENTOLOGY - VICTIM 
Computer Intrusion 
00: LA 


Synopsis: To cover a lead. 

Reference: 288A-LA-249816 Serial 34 


Enclosure(s) : E nclosed for SAI is an FD-302 documenting 

the interview of_and a lA envelope containing 

the original interview notes, a signed FD-395, a sign ed copy o f 
Title 18 use 1001 and copies of documents provided by_ 

Details : As requested by SA was 

interviewed concerning his knowledge of DDOS attacks against the 
Church of Scientology occurring in January and February of 2008. 
See attached FD-302 for details. 

FBI Newark considers this lead covered. 


UNCLASSIFIED 







UNCLASSIFIED 


To: Los Angeles From: Newark 

Re: 288A-LA-249816, 10/15/2008 

LEAD(s): 

Set Lead 1: (Info) 

LOS ANGELES 

AT LOS ANGELES, CA 
Read and clear. 

♦♦ 
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I 


/ 


Date of transcription 09 / 03 /2008 


mother of 
'was interviewed via te1ephone at! 




J 


Atter being advised of th e natur e of the interview and the identity 
of the interviewing agentl [provided the following information: 


b6 

b7C 


I_[told her that they conducted a denial of 

service attack on Sci entolo gy.ora. Bv "they", he meant over 475 b6 
people. I I w as at | at the time he participated b7c 

in the attack. | [ thought that there was no real damage, they 

just took up bandwidth. She did not know why he did it. 



Investigation on 9/3/08 _ at Los Angeles, CA _ (telephonically) 

File# 288A“LA~249816 Date dictated 

byj- 1 


b6 

b7C 


This document contains neither recommendations nor conclusions of the FBI. 
it and its conten ts ar e not to be distributed nutgidp 


It is the property of the FBI and is loaned to your agency; 


V tv/ t/V ViiOlll 
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Dale of transcription 10/27/2008 


Church or bcientogo avT 
conference call was] 
Scientology (”COS”) 


was inteitvieweci lFIa~ 


f 


with the 
l^lso on the 


After being advised of 
interviewing Agent and the nature of the interview, 
the following information: 


eiephone 
for the Church of 
the identity of the 


[provided 


IP address 
until the 24th of January. 


did not appear in the COS logs• 
The major COS websites had been moved 
the aforementioned IP address 


to Prolexic by the 24th. However, 
appears in the COS server logs because this IP was continuing to 
access COS servers outside those that hosted the main websites. 
This IP was port scanning to try to find additional COS servers 
that had not been moved to Prolexic. 


b6 

b7C 


b6 

b7C 



H*. 





b6 

b7C 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distribute d outside your a gency. 
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Date of transcription 10 /27/2008 


I _ _for the Church of Scientology, 

was interviewed viaT telephone at telephone number j j^g 

After being advised of the i dentity of the interviewing Agent and ^70 


the nature of the interview,] 
information: 


Iprovided the following 



Investigation on 10/27/08 _at Los Angeles, CA _ (telephonically) 

File# 288A-LA-249816 ^1 

Date dictated 



b7C 

This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 
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FEDERAL BUREAU OF INVESTIGATION 


Precedence : ROUTINE 

To: Los Angeles 

From: Los Angeles 

CY-1 _ 

Contact: _ 

Approved By: 

Drafted By: | 

Case ID #:V^88A-LA-249816 (Pending) 

188B-LA-A244126-C (Pending) 

Title: VICTIM NOTIFICATION FORM 

Synopsis: Victim Contact Information 

Reference: 288A-LA-249816 Serial 1 

Details: 


Date: 




02/08/2008 


VnsCase# 

CAgtName 

PContact 

BusName 

BusEiN 

BusAcct 

VicFirN 

VicMidN 

VicLastN 

SSAN 

VicDate 

VicDOD 

VicMinor 

DOB 

Race 

Sex 

Addr 

Addr2 

City 

State 

Country 

Zip 

Email 

HPhone 

Fax 


288A-LA-249816 


Business 

Church of Scientology 
000000000 


20080118 


b6 

b7C 


b6 

b7C 









To: Los Angeles ^H?om: Los Angeles 
Re: 288A-LA-249816, 02/08/2008 


VWrkAddr 

VWrkadd2 

VWrkCity 

VWrkSt 

VWrkCtry 

VWrkZip 

WEmail 

WPhone 

WFax 

VicPager 

NOKFirN 

NOKMidN 

NOKLastW 

NOKRel 

NOKAddr 

NOKAddr2 

NOKCity 

NOKState 

NOKCtry 

NOKZip 

NOKHEmal 

NOKWEmal 

NOKHPho 

NOKWPho 

NOKHFax 

NOKWFax 

NOKPager 

GrdFirN 

GrdMidN 

GrdLastN 

GrdRel 

GrdAddr 

GrdAddr2 

Grdeity 

GrdState 

GrdCtry 

GrdZip 

GrdHEmal 

GrdWEmal 

GrdHPho 

GrdWPho 

GrdHFax 

GrdWFax 

GrdPager 

PropRet 

TotLoss 

Lang. 

Disable 


3055 Wilshire Blvd 

Suite 900 

Los Angeles 

CA 

US 

90010 _ 


2134875385 


N 

000000000 

EN 
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b7C 
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